Anomali Cyber Watch: Newly-Discovered WinorDLL64 Backdoor Has Code Similarities with Lazarus GhostSecret, Atharvan Backdoor Can Be Restricted to Communicate on Certain Days

<p>The various threat intelligence stories in this iteration of the Anomali Cyber Watch discuss the following topics: <b>APT, Backdoors, DLL sideloading, Infostealers, Phishing, Social engineering,</b> and <b>Tunneling</b>. The IOCs related to these stories are attached to Anomali Cyber Watch and can be used to check your logs for potential malicious activity.</p> <p><img src="https://cdn.filestackcontent.com/KQiT8ozqSyiJu66cVtfZ"/><br/> <b>Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed.</b></p> <h2>Trending Cyber News and Threat Intelligence</h2> <div class="trending-threat-article"> <h3 id="article-1"><a href="https://www.welivesecurity.com/2023/02/23/winordll64-backdoor-vast-lazarus-arsenal/" target="_blank">WinorDLL64: A Backdoor From The Vast Lazarus Arsenal?</a></h3> <p>(published: February 23, 2023)</p> <p>When the Wslink downloader (WinorLoaderDLL64.dll) was first discovered in 2021, it had no known payload and no known attribution. Now ESET researchers have discovered a Wslink payload dubbed WinorDLL64. This backdoor uses some of Wslink functions and the Wslink-established TCP connection encrypted with 256-bit AES-CBC cipher. WinorDLL64 has some code similarities with the GhostSecret malware used by North Korea-sponsored Lazarus Group.<br/> <b>Analyst Comment:</b> Wslink and WinorDLL64 use a well-developed cryptographic protocol to protect the exchanged data. Innovating advanced persistent groups like Lazarus often come out with new versions of their custom malware. It makes it important for network defenders to leverage the knowledge of a wider security community by adding relevant premium feeds and leveraging the controls automation via Anomali Platform integrations.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/attackpattern/10057" target="_blank">[MITRE ATT&CK] T1587.001 - Develop Capabilities: Malware</a> | <a href="https://ui.threatstream.com/attackpattern/3712" target="_blank">[MITRE ATT&CK] T1059.001: PowerShell</a> | <a href="https://ui.threatstream.com/attackpattern/3707" target="_blank">[MITRE ATT&CK] T1106: Native API</a> | <a href="https://ui.threatstream.com/attackpattern/9718" target="_blank">[MITRE ATT&CK] T1134.002 - Access Token Manipulation: Create Process With Token</a> | <a href="https://ui.threatstream.com/attackpattern/9770" target="_blank">[MITRE ATT&CK] T1070.004 - Indicator Removal on Host: File Deletion</a> | <a href="https://ui.threatstream.com/attackpattern/10018" target="_blank">[MITRE ATT&CK] T1087.001 - Account Discovery: Local Account</a> | <a href="https://ui.threatstream.com/attackpattern/9701" target="_blank">[MITRE ATT&CK] T1087.002 - Account Discovery: Domain Account</a> | <a href="https://ui.threatstream.com/attackpattern/9863" target="_blank">[MITRE ATT&CK] T1083 - File And Directory Discovery</a> | <a href="https://ui.threatstream.com/attackpattern/9930" target="_blank">[MITRE ATT&CK] T1135 - Network Share Discovery</a> | <a href="https://ui.threatstream.com/attackpattern/9710" target="_blank">[MITRE ATT&CK] T1057 - Process Discovery</a> | <a href="https://ui.threatstream.com/attackpattern/3715" target="_blank">[MITRE ATT&CK] T1012: Query Registry</a> | <a href="https://ui.threatstream.com/attackpattern/13021" target="_blank">[MITRE ATT&CK] Picus: The System Information Discovery Technique Explained - MITRE ATT&CK T1082</a> | <a href="https://ui.threatstream.com/attackpattern/10082" target="_blank">[MITRE ATT&CK] T1614 - System Location Discovery</a> | <a href="https://ui.threatstream.com/attackpattern/12873" target="_blank">[MITRE ATT&CK] T1614.001 - System Location Discovery: System Language Discovery</a> | <a href="https://ui.threatstream.com/attackpattern/9983" target="_blank">[MITRE ATT&CK] T1016 - System Network Configuration Discovery</a> | <a href="https://ui.threatstream.com/attackpattern/9957" target="_blank">[MITRE ATT&CK] T1049 - System Network Connections Discovery</a> | <a href="https://ui.threatstream.com/attackpattern/9631" target="_blank">[MITRE ATT&CK] T1033 - System Owner/User Discovery</a> | <a href="https://ui.threatstream.com/attackpattern/9761" target="_blank">[MITRE ATT&CK] T1560.002 - Archive Collected Data: Archive Via Library</a> | <a href="https://ui.threatstream.com/attackpattern/3708" target="_blank">[MITRE ATT&CK] T1005: Data from Local System</a> | <a href="https://ui.threatstream.com/attackpattern/9839" target="_blank">[MITRE ATT&CK] T1531 - Account Access Removal</a><br/> <b>Tags:</b> malware:WinorDLL64, file-type:DLL, malware-type:Backdoor, filename:WinorDLL64.dll, detection:Wslink, actor:Lazarus, mitre-group:Lazarus Group, malware:Wslink, malware-type:Downloader, filename:WinorLoaderDLL64.dll, source-country:North Korea, source-country:KP, target-country:South Korea, target-country:KR, AES-CBC, Windows</p> </div> <div class="trending-threat-article"> <h3 id="article-2"><a href="https://symantec-enterprise-blogs.security.com/threat-intelligence/clasiopa-materials-research" target="_blank">Clasiopa: New Group Targets Materials Research</a></h3> <p>(published: February 23, 2023)</p> <p>Symantec researchers discovered attempts to disable Symantec Endpoint Protection. The threat group behind this activity, dubbed Clasiopa, has no established motivation or origin. It used some India-related strings (the "SAPTARISHI-ATHARVAN-101" mutex and the “iloveindea1998^_^” password), but it could be a false-flag indication. It is possible (low confidence) that Clasiopa uses brute force attacks on public facing servers as an initial infection vector. Its custom Atharvan backdoor receives communication-schedule commands from its C2, which can set an interval between communication attempts and/or restrict communication to certain days of week or to certain days of month. Clasiopa also uses a custom proxy tool, the Thumbsender hacking tool, and modified versions of the publicly available Lilith RAT.<br/> <b>Analyst Comment:</b> Clasiopa’s tendency for proxying and variable sleep intervals makes the detection harder. Defense-in-depth approach should be used to stop sophisticated threats that evolve and utilize various techniques of defense evasion. Host-based indicators for malware and tools used by Clasiopa are available in the Anomali Platform.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/attackpattern/9870" target="_blank">[MITRE ATT&CK] T1078 - Valid Accounts</a> | <a href="https://ui.threatstream.com/attackpattern/9628" target="_blank">[MITRE ATT&CK] T1090 - Proxy</a> | <a href="https://ui.threatstream.com/attackpattern/3713" target="_blank">[MITRE ATT&CK] T1562.001: Disable or Modify Tools</a> | <a href="https://ui.threatstream.com/attackpattern/3712" target="_blank">[MITRE ATT&CK] T1059.001: PowerShell</a> | <a href="https://ui.threatstream.com/attackpattern/9692" target="_blank">[MITRE ATT&CK] T1560 - Archive Collected Data</a> | <a href="https://ui.threatstream.com/attackpattern/9767" target="_blank">[MITRE ATT&CK] T1070 - Indicator Removal On Host</a> | <a href="https://ui.threatstream.com/attackpattern/9638" target="_blank">[MITRE ATT&CK] T1105 - Ingress Tool Transfer</a><br/> <b>Tags:</b> actor:Clasiopa, target-region:Asia, malware:Atharvan, malware-type:Backdoor, malware-type:RAT, detection:Backdoor.Atharvan, malware:Lilith, malware:Thumbsender, malware-type:Hacking tool, malware-type:Proxy tool, file-type:EXE, file-type:DB, file-type:ZIP, Communication schedule, wsmprovhost, PowerShell, target-industry:Material research, Windows</p> </div> <div class="trending-threat-article"> <h3 id="article-3"><a href="https://www.menlosecurity.com/blog/purecrypter-targets-government-entities-through-discord/" target="_blank">PureCrypter Targets Government Entities through Discord</a></h3> <p>(published: February 23, 2023)</p> <p>Multiple government organizations in the Asia-Pacific and North America regions have been targeted with phishing emails aiming to deliver PureCrypter, a commodity downloader. These emails contained a Discord app link pointing to a malicious, password-protected ZIP file. At the time of analysis, Menlo Labs researchers were not able to get the final payload from the compromised domain acting as a staging server. Analysis of similar PureCrypter samples showed that the likely payload was AgentTesla, or possibly some other remote access trojans/stealers (Redline Stealer), and ransomware (Eternity, Philadelphia, and others).<br/> <b>Analyst Comment:</b> It is not clear why this seemingly unsophisticated actor using commodity malware decided to attack the government sector. Even if the motivation is purely financial, these unsophisticated attacks should be taken seriously. Theft of funds and ransomware attacks can be devastating, and the simple trick of delivering a cloud link to a password-protected archive seemingly provides for low antivirus detection.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/attackpattern/9800" target="_blank">[MITRE ATT&CK] T1047 - Windows Management Instrumentation</a> | <a href="https://ui.threatstream.com/attackpattern/9814" target="_blank">[MITRE ATT&CK] T1055 - Process Injection</a> | <a href="https://ui.threatstream.com/attackpattern/3713" target="_blank">[MITRE ATT&CK] T1562.001: Disable or Modify Tools</a> | <a href="https://ui.threatstream.com/attackpattern/9835" target="_blank">[MITRE ATT&CK] T1497 - Virtualization/Sandbox Evasion</a> | <a href="https://ui.threatstream.com/attackpattern/9814" target="_blank">[MITRE ATT&CK] T1055 - Process Injection</a> | <a href="https://ui.threatstream.com/attackpattern/9591" target="_blank">[MITRE ATT&CK] T1027 - Obfuscated Files Or Information</a> | <a href="https://ui.threatstream.com/attackpattern/9592" target="_blank">[MITRE ATT&CK] T1027.002 - Obfuscated Files or Information: Software Packing</a> | <a href="https://ui.threatstream.com/attackpattern/9597" target="_blank">[MITRE ATT&CK] T1036 - Masquerading</a> | <a href="https://ui.threatstream.com/attackpattern/9633" target="_blank">[MITRE ATT&CK] T1003 - Os Credential Dumping</a> | <a href="https://ui.threatstream.com/attackpattern/13021" target="_blank">[MITRE ATT&CK] Picus: The System Information Discovery Technique Explained - MITRE ATT&CK T1082</a> | <a href="https://ui.threatstream.com/attackpattern/9986" target="_blank">[MITRE ATT&CK] T1518.001 - Software Discovery: Security Software Discovery</a> | <a href="https://ui.threatstream.com/attackpattern/9835" target="_blank">[MITRE ATT&CK] T1497 - Virtualization/Sandbox Evasion</a> | <a href="https://ui.threatstream.com/attackpattern/9702" target="_blank">[MITRE ATT&CK] T1010 - Application Window Discovery</a> | <a href="https://ui.threatstream.com/attackpattern/9710" target="_blank">[MITRE ATT&CK] T1057 - Process Discovery</a> | <a href="https://ui.threatstream.com/attackpattern/3708" target="_blank">[MITRE ATT&CK] T1005: Data from Local System</a> | <a href="https://ui.threatstream.com/attackpattern/9895" target="_blank">[MITRE ATT&CK] T1095 - Non-Application Layer Protocol</a> | <a href="https://ui.threatstream.com/attackpattern/9714" target="_blank">[MITRE ATT&CK] T1071 - Application Layer Protocol</a><br/> <b>Tags:</b> malware:PureCrypter, malware-type:Downloader, malware:Redline Stealer, .NET, malware:AgentTesla, malware-type:RAT, malware-type:Infostealer, DES, malware:Eternity, malware:Blackmoon, malware:Philadelphia, malware-type:Ransomware, target-sector:Government, target-region:Asia-Pacific, target-region:North America, Discord, file-type:ZIP, file-type:GZ, FTP server, DES, Windows</p> </div> <div class="trending-threat-article"> <h3 id="article-4"><a href="https://www.bitdefender.com/files/News/CaseStudies/study/428/Bitdefender-PR-Whitepaper-S1deloadStealer-creat6669-en-EN.pdf" target="_blank">S1deload Stealer – Exploring the Economics of Social Network </a></h3> <p>(published: February 22, 2023)</p> <p>Bitdefender researchers analyzed a novel infostealer dubbed S1deload Stealer that became a significant threat in the second half of 2022. The infection typically starts with social engineering to prompt a user to download and open an archive file. The archive has one visible, legitimate, digitally-signed executable that is used for DLL sideloading by invisible malicious files in the same archive. Additional malware and modules are being delivered via two additional cycles of downloading, extracting, and triggering DLL sideloading. S1deload Stealer can obtain user credentials, as well as imitate human behavior to boost engagement on videos and other content and mine for BEAM cryptocurrency.<br/> <b>Analyst Comment:</b> Users should be warned about the risk of clicking on executable files from suspicious downloads. An unusually high CPU usage and overheating can be a sign of the malicious resource hijacking for cryptocurrency mining and playing videos in a hidden browser.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/attackpattern/9615" target="_blank">[MITRE ATT&CK] T1204.002 - User Execution: Malicious File</a> | <a href="https://ui.threatstream.com/attackpattern/10104" target="_blank">[MITRE ATT&CK] T1574.002 - Hijack Execution Flow: Dll Side-Loading</a> | <a href="https://ui.threatstream.com/attackpattern/9838" target="_blank">[MITRE ATT&CK] T1140 - Deobfuscate/Decode Files Or Information</a> | <a href="https://ui.threatstream.com/attackpattern/10025" target="_blank">[MITRE ATT&CK] T1555.003 - Credentials from Password Stores: Credentials From Web Browsers</a> | <a href="https://ui.threatstream.com/attackpattern/9715" target="_blank">[MITRE ATT&CK] T1071.001 - Application Layer Protocol: Web Protocols</a> | <a href="https://ui.threatstream.com/attackpattern/9617" target="_blank">[MITRE ATT&CK] T1041 - Exfiltration Over C2 Channel</a> | <a href="https://ui.threatstream.com/attackpattern/10023" target="_blank">[MITRE ATT&CK] T1496 - Resource Hijacking</a> | <a href="https://ui.threatstream.com/attackpattern/3707" target="_blank">[MITRE ATT&CK] T1106: Native API</a> | <a href="https://ui.threatstream.com/attackpattern/9933" target="_blank">[MITRE ATT&CK] T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder</a> | <a href="https://ui.threatstream.com/attackpattern/3717" target="_blank">[MITRE ATT&CK] T1564.001: Hidden Files and Directories</a> | <a href="https://ui.threatstream.com/attackpattern/10031" target="_blank">[MITRE ATT&CK] T1539 - Steal Web Session Cookie</a> | <a href="https://ui.threatstream.com/attackpattern/9779" target="_blank">[MITRE ATT&CK] T1564.003 - Hide Artifacts: Hidden Window</a> | <a href="https://ui.threatstream.com/attackpattern/10104" target="_blank">[MITRE ATT&CK] T1574.002 - Hijack Execution Flow: Dll Side-Loading</a> | <a href="https://ui.threatstream.com/attackpattern/10081" target="_blank">[MITRE ATT&CK] T1036.005 - Masquerading: Match Legitimate Name Or Location</a><br/> <b>Signatures:</b> <a href="https://ui.threatstream.com/signature/106459" target="_blank">S1deloadStealer. YARA by Bitdefender</a> | <a href="https://ui.threatstream.com/signature/106460" target="_blank">S1deloadStealer. ID Generation YARA by Bitdefender</a> | <a href="https://ui.threatstream.com/signature/106461" target="_blank">S1deloadStealer. PDB Path YARA by Bitdefender</a><br/> <b>Tags:</b> malware:S1deload, malware-type:Infostealer, .NET, file-type:DLL, file-type:ZIP, file-type:EXE, file-type:DAT, DLL sideloading, malware:miniZ, malware-type:Cryptominer, Cryptocurrency, BEAM cryptocurrency, Facebook, YouTube, Windows</p> </div> <div class="trending-threat-article"> <h3 id="article-5"><a href="https://symantec-enterprise-blogs.security.com/threat-intelligence/hydrochasma-asia-medical-shipping-intelligence-gathering" target="_blank">Hydrochasma: Previously Unknown Group Targets Medical and Shipping Organizations in Asia</a></h3> <p>(published: February 22, 2023)</p> <p>A new threat actor dubbed Hydrochasma has been targeting shipping companies and medical laboratories in Asia since at least October 2022. This campaign is likely motivated by intelligence gathering with a possible interest in COVID-19-related treatments or vaccines. The attack likely starts with an email attachment: an executable mimicking a document file. Hydrochasma relies exclusively on publicly available and living-off-the-land tools. Fast Reverse Proxy and Meterpreter are being dropped for remote access, followed by the use of other tools for scanning (AlliN, Fscan, and Gogo), password dumping (BrowserGhost, Process Dumper), tunneling (Dogz, Gost, and SoftEtherVPN), remote control (Cobalt Strike), and other functions (HackBrowserData, Ntlmrelay).<br/> <b>Analyst Comment:</b> All known Hydrochasma indicators are available in the Anomali platform and customers are advised to block these on their infrastructure.<br/> <b>MITRE ATT&CK:</b> <a href="https://ui.threatstream.com/attackpattern/10028" target="_blank">[MITRE ATT&CK] T1566.002 - Phishing: Spearphishing Link</a> | <a href="https://ui.threatstream.com/attackpattern/9612" target="_blank">[MITRE ATT&CK] T1204 - User Execution</a> | <a href="https://ui.threatstream.com/attackpattern/9638" target="_blank">[MITRE ATT&CK] T1105 - Ingress Tool Transfer</a> | <a href="https://ui.threatstream.com/attackpattern/9628" target="_blank">[MITRE ATT&CK] T1090 - Proxy</a> | <a href="https://ui.threatstream.com/attackpattern/9808" target="_blank">[MITRE ATT&CK] T1003.001 - OS Credential Dumping: Lsass Memory</a> | <a href="https://ui.threatstream.com/attackpattern/9599" target="_blank">[MITRE ATT&CK] T1555 - Credentials From Password Stores</a> | <a href="https://ui.threatstream.com/attackpattern/9974" target="_blank">[MITRE ATT&CK] T1550.003 - Use Alternate Authentication Material: Pass The Ticket</a><br/> <b>Tags:</b> actor:Hydrochasma, target-region:Asia, target-industry:Shipping, target-industry:Healthcare, malware:Cobalt Strike, malware:Fast Reverse Proxy, malware:GoGo, malware-type:Scanning tool, malware:Fscan, malware:AlliN, malware:Dogz, malware-type:Proxy tool, malware:Process Dumper, SoftEtherVPN, Procdump, malware:BrowserGhost, malware-type:Infostealer, malware:Gost proxy, malware-type:Tunneling tool, Ntlmrelay, Task Scheduler, Go-strip, HackBrowserData, malware:Meterpreter, Metasploit, file-type:EXE, file-type:PNG, COVID-19, COVID-19 vaccine, Windows</p> </div>